Deployment Architecture

Not able to create new index in standalone instance of Splunk indexer

rupeshn
Explorer

Hi All, I've created new app with all the indexes required and have added all the stanzas for parameters.Restarted the Splunk on Indexer. Now when i login all is good. The indexes are reflected in GUI and logs are ingesting. But when i try to create new index. It is throwing e a below error.

stanza=alm_win_allservers parameter=frozenTimePeriodInSecs Value supplied='12096000‬' is illegal; default='188697600' Could you please help here

Tags (2)
0 Karma
1 Solution

anilchaithu
Builder

@rupeshn 

looks like the stanza is not thinking this as an integer. Did you copy this value from elsewhere? try to enter the value manually and check.

View solution in original post

anilchaithu
Builder

@rupeshn 

looks like the stanza is not thinking this as an integer. Did you copy this value from elsewhere? try to enter the value manually and check.

rupeshn
Explorer

Sorry! I did not get time to check on this. Today i checked it and it worked fine.

 

Thank You!

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...